0d503ca7d25aea8e719b3e2961e8449b_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

0d503ca7d25aea8e719b3e2961e8449b_JaffaCakes118
Size

11KB
MD5

0d503ca7d25aea8e719b3e2961e8449b
SHA1

22d3218d1a9b196a2f6f8675f1ebab61ef75d750
SHA256

7ac23f5597f84e6c492616c9d35dbe218d8723edc61d404f978e408e835dee87
SHA512

a8da692237eb85ce035f92b530725845f16caf4c6cda437b9802e1fffb8fa6d04d8d84a604487486aedab40e5eab95e115a838b9c06e5389d93be54316ab8d2e
SSDEEP

192:pMNTJfBHPOM0e6Ruw5seJunr2VUi0fHo3FMyB6FYtGyq3VfyXAMp:mNdgt7uosNr2p0fHo1192ZyX

Score

5^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
sample	upx

Unsigned PE 2 IoCs

Checks for missing Authenticode signature.

resource
0d503ca7d25aea8e719b3e2961e8449b_JaffaCakes118
unpack001/out.upx

Files

0d503ca7d25aea8e719b3e2961e8449b_JaffaCakes118
.dll windows:4 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Sections

UPX0
Size: - Virtual size: 28KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

UPX1
Size: 9KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

UPX2
Size: 1024B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
out.upx
.dll windows:4 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Sections

.data
Size: 16KB - Virtual size: 23KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.CRT
Size: 512B - Virtual size: 16B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ